Firewall: Configuration Basics and Designing a Secure Traffic Policy
8 September 2026 · 7 min read
A firewall is a device or program that decides, based on a set of rules, whether network packets may pass. Its core job — whether iptables/ufw on Linux or a hardware firewall — is managing traffic between the network boundary and the outside world, in both directions.
Deny-by-default: the golden rule of design
The best starting point for any firewall policy:
sudo ufw default deny incoming
sudo ufw default allow outgoingClose everything first, then open only what you truly need. If you forget a service, the default stays secure; with an allow-by-default policy, a forgotten service is an open door.
Anatomy of a good rule
Define every rule with four questions:
- Source: who (IP/network)
- Destination: which server or service
- Port and protocol: e.g., 443/tcp
- Action: allow, deny, or inspect
Example for a web server: allow everyone in on port 443 over TCP.
Zone separation (Zoning): an architecture that matters
- Internal network: high trust, tight control
- DMZ: public services (web, email) kept separate from the internal network
- Internet: the outside world
Traffic between these zones is minimal and controlled, so if one is compromised it can't spread to the rest. This concept is complemented by VLAN segmentation in Office Network Setup.
Logging: eyes that must not be blind
- Log denied traffic so suspicious behavior (port scans, login attempts) can be seen
- For larger organizations, send logs to a central system (SIEM)
- Enable tools like fail2ban for software firewalls (more in Linux Server Hardening)
Periodic review: keep rules clean
Rules accumulate over time: test rules, changed IPs, and removed services. The plan:
- Every six months, review all the rules and remove unused ones
- Before any change, back up the current configuration
- After a change, test both pass (allowed) and deny (blocked) scenarios
Summary
A firewall is not just a 'wall'; it is a policy system: deny-by-default, logging, separation, and periodic review. With these four principles alone — without buying expensive equipment — you can lock down your network boundary professionally. To reinforce boundary security, also read CIA Principles.
FAQ
What does deny-by-default mean and why does it matter?
It means all traffic is forbidden at first, and only what is explicitly allowed may pass. This prevents the consequences of forgotten services.
What is the difference between a hardware and a software firewall?
A hardware firewall manages traffic between networks at a high level and independently; a software one (like ufw/iptables) runs on the host itself for that server's services. Full deployments use both.
Where exactly does the DMZ sit?
It is a network zone separate from the main network where publicly accessible services (web, mail) live; if that service is breached, the internal network isn't directly at risk.
Why should I review firewall rules?
Over time, test rules, obsolete IPs and removed services accumulate and enlarge the attack surface; periodic reviews keep them clean and readable.